Analysis System Design - Twin Servo Power Units When the port side main steering pump was selected, so too was the port side servo power unit and likewise for the starboard side steering pump/servo power unit combination. When working with both main steering pumps, both servo power units were also working in tandem. There are distinct advantages when working two main steering gear pumps simultaneously. Rudder response speed is increased and realtime redundancy for the steering gear is assured. The International Convention for the Safety of Life at Sea(SOLAS), in fact, specifies the use of two main steering gear pumps where navigation demands special caution.9 On the other hand, there are fewer advantages to running two servo power units simultaneously and, depending on the arrangement, some potential disadvantages. Although realtime redundancy is, in theory, assured, there is no real gain in rudder response time. With an arrangement such as on the Cedar, both servo power units must be precisely calibrated (flow and pressure) to give the same performance for a given control input. Any difference in output between the servo power units, for a given input, will result in one fighting the other. At the time of loss of rudder control, both main steering gear pumps were in use, and by design so too were both servo power units. After the grounding, the ship's electrician transferred the steering gear control from the wheelhouse to the steering gear flat using the emergency remote control transfer switch. Control of the rudder returned to normal after this action. This switch was carefully examined and many wires were found to be loose. One particularly loose wire carried control signals for port rudder movement to the starboard servo power unit DCV solenoid. Between 1420 and 1422, port helm was applied in an attempt to stop the vessel's swing to starboard. An analysis of the recorded rudder movement shows that the rudder replied to the port helm commands in brief bursts (Figure3). This would indicate intermittent performance of the rudder which is consistent with an on/off activation of the DCV solenoid for port helm, most probably caused by a loose wire alternately making contact and then losing contact. Figure3. Recorded rudder movement The installation of the port and starboard servo power units did not conform to the plans submitted to LR. Specifically, these units did not have a functional hydraulic bypass arrangement for the servo cylinders. As noted, both port and starboard DCV solenoids are normally activated during steering operations, even if only one servo power unit is in use. The DCVs had thus acted as defacto bypass valves and had concealed the inappropriately installed servo cylinder bypass valves when only one servo power unit was being used. A malfunction of (or lack of control signal to) the DCV solenoid of either servo power unit, regardless of whether one or both units were in use, would create a hydraulic lock. The incorrectly installed servo cylinder bypass valves were not a factor in the grounding but under other circumstances, such as with only the port servo power unit in use, it could well have become one. Also, the mis-installation would have repercussions in the event that the vessel was steered using the trick wheel. Even though the port servo power unit was in operation, it could not overcome the starboard servo cylinder that was in hydraulic lock (positive servo pump pressure but DCV in the neutral position due to lack of control signal). This effectively rendered the steering gear inoperable, without an accompanying alarm. Redundancy, while intrinsically a good thing, must be properly applied within a system in order to serve its intended purpose. Alarms At approximately 1420, the rudder stopped responding to helm orders, yet there was no accompanying alarm. The helmsman provided the navigation team with its first indication that something was wrong with the vessel's steering. In quick order, both NFU joysticks in the wheelhouse were tried without effect. Although power supply for both the main steering pumps and the servo pumps was monitored and had an alarm function, there was no alarm for the low voltage control signal. Ideally, an alarm function should give the operator notice that the monitored device is not producing its intended output. In many cases, alarm function is tapped at the power supply junction - if there is no power supply, there is no output. This is also a SOLAS requirement for a steering gear control system. In this instance, because of a loose wire within the emergency remote control transfer switch, the starboard DCV solenoid was not receiving the port helm command. Consequently, no port helm was actioned by this servo power unit. Also, the port DCV solenoid was receiving a port helm command, but could not operate the port servo cylinder against the hydraulically-locked starboard servo cylinder. As hydraulic pressure built up to the maximum output of the port servo pump, the safety valve would open, dumping the hydraulic fluid back into the tank. Although the steering gear control equipment had effectively failed to perform, no corresponding alarms had been activated. Alarm function taken from the power source remains the most pragmatic and simple solution for notifying the operator that a device is not performing its intended output. It is not an infallible concept, however, and an absence of an alarm under these circumstances does not necessarily mean the device is indeed operational. The alarm function for the steering gear control system was taken at a point upstream of other possible failure points. Although conforming to the letter of SOLAS for alarm function, any failure downstream of this point would render the servo power unit inoperable without a corresponding alarm. Quality Control, Testing and Acceptance of Steering Arrangements Many indications were found of substandard workmanship and components related to the steering arrangements and, in particular, the servo power units, such as; servo cylinder bypass valves improperly installed; inadequate crimping of wire connections; no detailed plan available for the servo power unit system; bending, fitting and braising work for the servo power unit's hydraulic piping less than adequate (although not a factor in the grounding). Most of the above did not contribute to this particular grounding, but considering the Cedar was on its maiden voyage, it was a matter of time before one or another caused an occurrence. Since poor workmanship must ultimately pass Class/Flag survey before being accepted into service, this also indicates a less-than-adequate quality control at this level. On the Cedar, a sophisticated telemotor transmitter is linked, via a servo power unit system, to an approved steering gear. Detailed plans and specifications were available, on board, for both the steering gear and remote control mechanism. This, however, was not the case for the servo power unit system. A system is only as strong as its weakest link. Consequently, it is essential that there be no deviation from the specification or design of the equipment during its assembly. Further, adequate testing and careful survey are essential to ensure that the as built arrangements conform to plans, specifications and intended use. Had proper tests of trick wheel operation been carried out prior to or upon delivery of the vessel, the improperly installed servo cylinder bypass valves would have been detected. Compromised safety of vessels and personnel from less-than-adequate quality of inspection has been identified as a factor in other TSB investigation reports.10 Quality control during vessel construction and rigorous standards for quality of inspection are essential elements for ensuring a safe vessel. This has been recognized by the International Association of Classification Societies (IACS) and the classification societies themselves, who view their role as a vital link in the safety chain for shipping.11 Towards that objective, they have instituted a number of programs including enhanced class surveys (ECS) and early warning systems (EWS). Shipboard inspections by Class surveyors must be held to a high standard if the mission objective is to be met. Trick Wheel Operating Instructions The trick wheel in the steering flat of the Cedar allows control signals to be manually inputted to the steering gear via the floating lever. It essentially does the job of the servo power units in the event of their failure. There must be zero pressure within the servo power unit hydraulic circuit (servo pump off), and there must be a functioning bypass arrangement in each circuit to allow movement of the trick wheel once it has been engaged with the floating lever. As mentioned earlier, bypass arrangements on the Cedar were not functional. This meant that the trick wheel could not be used without first disengaging the servo cylinders from the floating lever. To ensure safety, it is essential that concise and complete instructions be posted for the operation of emergency steering equipment. SOLAS gives guidance in this respect, calling for simple instructions for emergency steering gear changeover to be posted on the bridge and in the steering gear compartment.12 Neither Cedar nor the sister ship Pine had complete and unambiguous operating instructions for use of the trick wheel. The situation is further confused by having two sets of operating instructions posted on each vessel, each slightly different than the other. The instructions did not accurately reflect the procedures necessary to operate the trick wheel on the Cedar, given that the bypass valves had been incorrectly installed. Although not a factor in this grounding, the varying, incomplete and vague instructions posted for the trick wheel operation could hamper effective action during an emergency. A loose wire within the emergency remote control transfer switch resulted in an intermittent control signal and failure of the steering system to perform as required. The system design of the twin telemotor receiver arrangement was such that, during simultaneous operation, the failure of one unit could create a hydraulic lock condition and prevent the other unit from operating.Findings as to Causes and Contributing Factors A loose wire within the emergency remote control transfer switch resulted in an intermittent control signal and failure of the steering system to perform as required. The system design of the twin telemotor receiver arrangement was such that, during simultaneous operation, the failure of one unit could create a hydraulic lock condition and prevent the other unit from operating. Quality control of the assembly during construction and functionality of the servo power units' hydraulic and electrical components prior to delivery was inadequate. Full and complete emergency steering tests using the trick wheel were not carried out prior to or upon delivery of the vessel, resulting in an unnoticed latent defect within the steering gear until the accident. Varying, incomplete and vague instructions for trick wheel operation may hamper effective and timely action during an emergency. The alarm function for the steering gear control was taken at a point upstream of other possible failure points. Any failure downstream of this point would render the servo power unit inoperable without a corresponding alarm. The quality of workmanship, the material used and the method of bending and connecting the servo unit hydraulic piping of this new ship were substandard. These defects were neither remarked upon by the vessel's classification society nor corrected by shipyard quality control.Findings as to Risk Quality control of the assembly during construction and functionality of the servo power units' hydraulic and electrical components prior to delivery was inadequate. Full and complete emergency steering tests using the trick wheel were not carried out prior to or upon delivery of the vessel, resulting in an unnoticed latent defect within the steering gear until the accident. Varying, incomplete and vague instructions for trick wheel operation may hamper effective and timely action during an emergency. The alarm function for the steering gear control was taken at a point upstream of other possible failure points. Any failure downstream of this point would render the servo power unit inoperable without a corresponding alarm. The quality of workmanship, the material used and the method of bending and connecting the servo unit hydraulic piping of this new ship were substandard. These defects were neither remarked upon by the vessel's classification society nor corrected by shipyard quality control. Safety Action Action Taken Subsequent to the grounding and while at Qubec, Quebec between 19-23November2001, the following action was taken on board the Cedar: Servo power unit hydraulic piping was changed for steel pipes, properly bent and sized. The piping was also fitted so as to forego any welding or braising. Main power switches for both port and starboard servo power units were changed for more robust switches. Single telemotor use was instigated by installing a selector switch on the bridge and decoupling activation of each servo power unit from its respective main steering gear pump. Port and starboard servo cylinder bypass valves were re-installed in an appropriate fashion. Hydraulic servo power unit plans were drawn up and filed on board. All loose connections within the steering flat emergency remote control transfer switch were properly crimped and secured.